Skip to content

Bump jsonschema from 4.17.3 to 4.18.0

Johannes Zumthurm requested to merge dependabot/pip/jsonschema-4.18.0 into master

Created by: dependabot[bot]

Bumps jsonschema from 4.17.3 to 4.18.0.

Release notes

Sourced from jsonschema's releases.

v4.18.0

What's Changed

This release majorly rehauls the way in which JSON Schema reference resolution is configured. It does so in a way that should be backwards compatible, preserving old behavior whilst emitting deprecation warnings.

  • jsonschema.RefResolver is now deprecated in favor of the new referencing library. referencing will begin in beta, but already is more compliant than the existing $ref support. This change is a culmination of a meaningful chunk of work to make $ref resolution more flexible and more correct. Backwards compatibility should be preserved for existing code which uses RefResolver, though doing so is again now deprecated, and all such use cases should be doable using the new APIs. Please file issues on the referencing tracker if there is functionality missing from it, or here on the jsonschema issue tracker if you have issues with existing code not functioning the same, or with figuring out how to change it to use referencing. In particular, this referencing change includes a change concerning automatic retrieval of remote references (retrieving http://foo/bar automatically within a schema). This behavior has always been a potential security risk and counter to the recommendations of the JSON Schema specifications; it has survived this long essentially only for backwards compatibility reasons, and now explicitly produces warnings. The referencing library itself will not automatically retrieve references if you interact directly with it, so the deprecated behavior is only triggered if you fully rely on the default $ref resolution behavior and also include remote references in your schema, which will still be retrieved during the deprecation period (after which they will become an error).
  • Support for Python 3.7 has been dropped, as it is nearing end-of-life. This should not be a "visible" change in the sense that requires-python has been updated, so users using 3.7 should still receive v4.17.3 when installing the library.
  • On draft 2019-09, unevaluatedItems now properly does not consider items to be evaluated by an additionalItems schema if items is missing from the schema, as the specification says in this case that additionalItems must be completely ignored.
  • Fix the date format checker on Python 3.11 (when format assertion behavior is enabled), where it was too liberal (#1076).
  • Speed up validation of unevaluatedProperties (#1075).

Deprecations

  • jsonschema.RefResolver -- see above for details on the replacement
  • jsonschema.RefResolutionError -- see above for details on the replacement
  • relying on automatic resolution of remote references -- see above for details on the replacement
  • importing jsonschema.ErrorTree -- instead import it via jsonschema.exceptions.ErrorTree
  • importing jsonschema.FormatError -- instead import it via jsonschema.exceptions.FormatError

New Contributors

Full Changelog: https://github.com/python-jsonschema/jsonschema/compare/v4.17.3...v4.18.0

v4.18.0a10

Full Changelog: https://github.com/python-jsonschema/jsonschema/compare/v4.18.0a9...v4.18.0a10

v4.18.0a9

Full Changelog: https://github.com/python-jsonschema/jsonschema/compare/v4.18.0a8...v4.18.0a9

... (truncated)

Changelog

Sourced from jsonschema's changelog.

v4.18.0

This release majorly rehauls the way in which JSON Schema reference resolution is configured. It does so in a way that should be backwards compatible, preserving old behavior whilst emitting deprecation warnings.

  • jsonschema.RefResolver is now deprecated in favor of the new referencing library <https://github.com/python-jsonschema/referencing/>_. referencing will begin in beta, but already is more compliant than the existing $ref support. This change is a culmination of a meaningful chunk of work to make $ref resolution more flexible and more correct. Backwards compatibility should be preserved for existing code which uses RefResolver, though doing so is again now deprecated, and all such use cases should be doable using the new APIs. Please file issues on the referencing tracker if there is functionality missing from it, or here on the jsonschema issue tracker if you have issues with existing code not functioning the same, or with figuring out how to change it to use referencing. In particular, this referencing change includes a change concerning automatic retrieval of remote references (retrieving http://foo/bar automatically within a schema). This behavior has always been a potential security risk and counter to the recommendations of the JSON Schema specifications; it has survived this long essentially only for backwards compatibility reasons, and now explicitly produces warnings. The referencing library itself will not automatically retrieve references if you interact directly with it, so the deprecated behavior is only triggered if you fully rely on the default $ref resolution behavior and also include remote references in your schema, which will still be retrieved during the deprecation period (after which they will become an error).
  • Support for Python 3.7 has been dropped, as it is nearing end-of-life. This should not be a "visible" change in the sense that requires-python has been updated, so users using 3.7 should still receive v4.17.3 when installing the library.
  • On draft 2019-09, unevaluatedItems now properly does not consider items to be evaluated by an additionalItems schema if items is missing from the schema, as the specification says in this case that additionalItems must be completely ignored.
  • Fix the date format checker on Python 3.11 (when format assertion behavior is enabled), where it was too liberal (#1076).
  • Speed up validation of unevaluatedProperties (#1075).

Deprecations

  • jsonschema.RefResolver -- see above for details on the replacement
  • jsonschema.RefResolutionError -- see above for details on the replacement
  • relying on automatic resolution of remote references -- see above for details on the replacement
  • importing jsonschema.ErrorTree -- instead import it via jsonschema.exceptions.ErrorTree
  • importing jsonschema.FormatError -- instead import it via jsonschema.exceptions.FormatError
Commits
  • 1fe3f9f Merge pull request #1111 from python-jsonschema/pre-commit-ci-update-config
  • e2998b7 [pre-commit.ci] pre-commit autoupdate
  • 32fe8b1 Merge pull request #1109 from python-jsonschema/pre-commit-ci-update-config
  • ea26319 [pre-commit.ci] pre-commit autoupdate
  • eb8255a Merge pull request #1104 from python-jsonschema/pre-commit-ci-update-config
  • 743fe39 [pre-commit.ci] pre-commit autoupdate
  • d35f2c2 Only use a default (remote retrieving registry) when none is provided.
  • 685578a Massage coverage numbers again.
  • 1240e68 Don't uselessly recombine registries each time we recurse into subschemas.
  • b62bcfb Add Unlicense to the allowed non-GPL license audit list.
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Merge request reports